Who We Insure
Medical Device Insurance: Recalls, Bodily Injury, FDA Cybersecurity Rules and SaMD Errors
Medical device insurance is organized around the moment a product touches a patient. Before clearance, the exposure is clinical trial liability and the investor claims that follow a failed study; after launch, it is products liability for bodily injury, recall costs, and the professional liability that attaches to software as a medical device when an algorithm's output is wrong. Connected devices add a layer the industry did not carry a decade ago: the FDA now reviews cybersecurity as part of premarket submissions, and a vulnerability in a device fleet is both a safety issue and a breach.
Why medical device companies carry specialized insurance
Device companies also carry the obligations of a manufacturer whether or not they own a factory. Contract manufacturers, component suppliers, and distributors each hold a piece of the liability, and the supply agreements decide how a claim moves between them. Hospitals and group purchasing organizations set insurance minimums that assume the device company is the party of record, so a startup with an outsourced build still needs a manufacturer's program. This guide covers products liability and recall, clinical trial liability, Tech E&O for software as a medical device, cyber built around FDA premarket cybersecurity expectations, D&O, and the hospital, distributor, and underwriting requirements that follow a device from first-in-human study to commercial launch.
Who this guide is for
Written for founders, regulatory and quality leaders, general counsel, and finance leads at companies developing or marketing medical devices and software as a medical device. Class I through Class III device developers, from wearables and diagnostics hardware to implantables and surgical systems; Software as a medical device and AI-enabled diagnostic and decision-support companies; Digital therapeutics and connected drug-delivery device companies; Not for wellness wearables outside FDA's device definition — the fitness and wellness app guide covers them.
The risk profile of a medical device company
Device claims arrive as individual injuries, as mass actions after a recall, and as investor suits after a regulatory setback. Each stage of development changes which one leads. Key exposures: Bodily injury from device malfunction, design defect, or inadequate warnings, including implant failures that produce multi-plaintiff litigation; Recall costs — notification, retrieval, replacement, and lost revenue — after a field safety issue or an FDA request; Clinical trial participant injury during feasibility and pivotal studies, with site and country-specific insurance requirements; Software as a medical device errors: a missed finding, a wrong dose recommendation, an algorithm that performs differently on a subgroup; Cybersecurity vulnerabilities in connected devices, with safety communications, patch obligations, and breach of patient data from device telemetry; Investor and securities claims after a failed study, a warning letter, a clearance delay, or a recall announcement.
Products Liability and Recall for medical device companies
The core policy for any device on the market: bodily injury and property damage caused by the device, with defense of design, manufacturing, and warning claims. Life sciences products forms add coverage for products in clinical use before approval and for the professional element of device output. Recall expense coverage — the company's own cost to notify, retrieve, and replace — is a separate purchase that most standard products forms exclude and that hospital customers increasingly ask about. Typically responds to: patient and user injury claims from devices in commercial distribution; defense of warnings, labeling, and design-defect allegations; recall and withdrawal costs where recall coverage is purchased.
Clinical Trial Liability for medical device companies
Feasibility, pivotal, and post-market studies need participant-injury coverage that satisfies institutional review boards, sites, and, for international studies, country-specific requirements and certificates. It is placed per study or as a master policy with study schedules, and it sits alongside the products policy rather than inside it.
Technology E&O for Software as a Medical Device for medical device companies
Software that diagnoses, triages, or recommends treatment generates professional and performance claims that a products form may not reach and a technology form may exclude as bodily injury. The solution is a Tech E&O policy whose bodily injury exclusion is carved back for the software's clinical function, coordinated with the products policy so a wrong output is covered however it is pleaded.
Cyber Liability for Connected Devices for medical device companies
The FDA expects a cybersecurity plan, a software bill of materials, and a process for post-market vulnerability management in premarket submissions for cyber devices. Cyber insurance covers breach response for device telemetry and patient data, extortion, and liability, and it should be checked for exclusions of bodily injury and of the device as property, since a device-fleet vulnerability can become both a safety communication and a breach at once.
Directors & Officers (D&O) for medical device companies
Device companies raise money on study readouts and clearance timelines, and each is a binary event that can produce investor claims. D&O defends directors and officers against securities, investor, and regulatory proceedings, including those that follow a warning letter or recall, and it is required at every institutional financing.
Contract and certificate requirements
Hospitals, health systems, and group purchasing organizations require products liability at stated limits — often in the millions per occurrence for implantables — plus general liability, cyber for connected devices, and workers' compensation, with additional-insured status and indemnities for product claims. Distributors require products liability naming them. Clinical sites and institutional review boards require clinical trial liability with their own minimums and, abroad, local certificates. Supply and contract-manufacturing agreements allocate liability between the device company, the manufacturer, and component suppliers, with mutual indemnities and insurance requirements in both directions. The device company should carry a full manufacturer's program regardless of how the indemnities read, because it holds the clearance and is the party patients and hospitals name.
What coverage costs
Products liability pricing for a device company follows device class and invasiveness, units in the field and expected sales, the clinical consequence of failure, quality system maturity, complaint and adverse-event history, and the limits customers require. Implantables and life-sustaining devices price at the top; low-risk diagnostics and wearables at the bottom. Recall coverage is priced separately on the same factors. Clinical trial liability is priced per study on enrollment, countries, and risk profile. Tech E&O and cyber follow revenue, the software's clinical role, the connected-device footprint, and security controls, including the premarket cybersecurity documentation. D&O follows financing stage and regulatory milestones ahead. As of 2026, device programs are built in stages as the product moves from study to market, and limits rise with the customer contracts rather than on a schedule.
What underwriters will ask for
Device underwriters read the regulatory and quality file, and connected-device underwriters now read the cybersecurity file as well. Have ready: Device description, classification, regulatory pathway and status, indications, and intended-use statements; Quality management system certification, design controls, complaint handling, and corrective and preventive action records; Clinical study schedule with enrollment, sites, countries, and the protocol risk profile; Units sold or planned, distribution channels, customer contracts, and supply and manufacturing agreements; Cybersecurity documentation for connected devices: threat model, software bill of materials, patching process, and premarket submission content; Adverse events, complaints, recalls, warning letters, and claims history.
Illustrative example: The infusion pump and the field correction
A connected infusion pump's software update introduces a dosing display error under a specific configuration. Two patients are overdosed before the pattern is identified. The company issues a field correction, the FDA classifies it as a recall, and the patients' families file suit while a hospital customer invokes its indemnity. Products liability defends the injury claims and the hospital's tender; recall expense coverage, if purchased, funds the correction campaign. Investor inquiries that follow the recall announcement are a D&O matter. The design-control and change-control records are the evidence in every forum.
Illustrative example: The algorithm that missed the finding
A software-as-a-medical-device company's imaging triage tool fails to flag a hemorrhage in a scan, and treatment is delayed. The patient's claim names the radiology group, the hospital, and the software company, alleging the algorithm performed worse on the scanner model used at that site. Tech E&O with the clinical-function carve-back responds to the claim against the software company, coordinated with the products policy for the bodily-injury element. Validation data across scanner models and the labeling's stated limitations determine how the claim is defended.
What does medical device insurance cost?
Pricing follows device class and invasiveness, units in the field, the clinical consequence of failure, quality system maturity, study activity, connected-device footprint, financing stage, and customer limits, so there is no standard figure. As of 2026, companies typically start with clinical trial liability and D&O during studies and add products liability, recall, and cyber as they approach commercial launch.
Do we need products liability before FDA clearance?
Devices used in studies are covered by clinical trial liability for participant injury, but companies often add products liability before clearance to satisfy study sites, early-access programs, and investors, and to avoid a gap on the day of launch. Life sciences forms can cover both stages under one program.
Is a recall covered by products liability?
Generally not. Products liability covers injury and damage to third parties; the company's own cost to notify, retrieve, replace, and dispose of product is excluded by most forms and insured separately through recall expense coverage. Hospital customers and distributors increasingly ask whether it is in place.
Does the FDA's cybersecurity guidance change insurance requirements?
It changes underwriting. Cyber and products underwriters ask for the premarket cybersecurity documentation — threat model, software bill of materials, vulnerability management plan — and the absence of it affects both terms and pricing for connected devices. Contracts with health systems increasingly require cyber coverage specific to the device.
Does software as a medical device need products liability or E&O?
Both, coordinated. A wrong output can be pleaded as a product defect causing bodily injury or as a professional error in the software's performance, and standard forms each exclude the other framing. The products policy and a Tech E&O policy with a clinical carve-back should be placed together so coverage does not depend on the plaintiff's choice of words.
Caveats and common gaps
Recall expense is a separate coverage, not part of products liability. Technology E&O bodily-injury exclusions and products-form professional-services exclusions must be reconciled for software devices. Cyber forms may exclude bodily injury and the device as property. Clinical trial coverage is study- and country-specific and should be confirmed before enrollment.
Related guides
Hardware and IoT companies — the broader connected-hardware industry page · Insurance for Clinical Trial Sponsors & CROs — participant-injury coverage and site requirements in depth · Product liability and completed operations coverage — the core manufacturer's policy · Insurance for Remote Patient Monitoring Companies — device fleets with clinical monitoring services · Insurance for Genetic Testing & Diagnostics Companies · Insurance for Healthtech Companies · Tech E&O insurance · Insurance for Digital Therapeutics Companies — software as a medical device · Insurance for Senior Care & AgeTech Companies
Frequently asked questions
What does medical device insurance cost?
Pricing follows device class and invasiveness, units in the field, the clinical consequence of failure, quality system maturity, study activity, connected-device footprint, financing stage, and customer limits, so there is no standard figure. As of 2026, companies typically start with clinical trial liability and D&O during studies and add products liability, recall, and cyber as they approach commercial launch.
Do we need products liability before FDA clearance?
Devices used in studies are covered by clinical trial liability for participant injury, but companies often add products liability before clearance to satisfy study sites, early-access programs, and investors, and to avoid a gap on the day of launch. Life sciences forms can cover both stages under one program.
Is a recall covered by products liability?
Generally not. Products liability covers injury and damage to third parties; the company's own cost to notify, retrieve, replace, and dispose of product is excluded by most forms and insured separately through recall expense coverage. Hospital customers and distributors increasingly ask whether it is in place.
Does the FDA's cybersecurity guidance change insurance requirements?
It changes underwriting. Cyber and products underwriters ask for the premarket cybersecurity documentation — threat model, software bill of materials, vulnerability management plan — and the absence of it affects both terms and pricing for connected devices. Contracts with health systems increasingly require cyber coverage specific to the device.
Does software as a medical device need products liability or E&O?
Both, coordinated. A wrong output can be pleaded as a product defect causing bodily injury or as a professional error in the software's performance, and standard forms each exclude the other framing. The products policy and a Tech E&O policy with a clinical carve-back should be placed together so coverage does not depend on the plaintiff's choice of words.
This material is general educational information, not legal, tax, or insurance advice. Coverage availability, policy terms, and regulatory requirements vary by state, carrier, and applicant.